lfg2025/archy
1
0
Fork 0
Code Issues 16 Pull Requests Actions Packages Projects Releases 44 Wiki Activity

fix(observability): mirror install_log() to tracing — file append is sandbox-dead

Browse Source 
/var/log/archipelago/container-installs.log has been 0 bytes since April:
the service sandbox (ProtectSystem=strict class) leaves /var/log
read-only for the unit, the open() fails, and install_log() drops every
line by design (fire-and-forget). These START/STOP/RESTART/FAIL
breadcrumbs are the primary forensic trail for gate failures, so mirror
every line to tracing (journald) unconditionally and keep the file
append as best-effort for hosts where the path is writable.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
archipelago 2026-07-09 03:09:08 -04:00
parent 2683ad4f0e
commit c3f0a306b4
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
core/archipelago/src/api/rpc/package/install.rs
View File

@ -24,6 +24,12 @@ const IMAGE_INSPECT_TIMEOUT: Duration = Duration::from_secs(10);
/// Append a timestamped line to the persistent install log.
pub(in crate::api::rpc) async fn install_log(msg: &str) {
use tokio::io::AsyncWriteExt;
// Always mirror to tracing/journald: the file append below has been
// silently failing under the service sandbox (ProtectSystem=strict
// leaves /var/log/archipelago read-only — container-installs.log has
// been 0 bytes since April 2026), and these lifecycle breadcrumbs are
// the primary forensic trail for gate failures.
info!(target: "install_log", "{msg}");
let ts = chrono::Utc::now().format("%Y-%m-%d %H:%M:%S UTC");
let line = format!("[{}] {}\n", ts, msg);
if let Ok(mut f) = tokio::fs::OpenOptions::new()